Talos ThreatSource Newsletters

Talos ThreatSource is a regular intelligence update from Cisco Talos, highlighting the biggest threats each week
and other security news.

May 02, 2019

Welcome to this week’s Threat Source newsletter — the perfect place to get caught up on all things Talos from the past week.

If you haven’t yet, there’s still time to register for this year’s Talos Threat Research Summit — our second annual conference by defenders, for defenders. This year’s Summit will take place on June 9 in San Diego — the same day Cisco Live kicks off in the same city. We sold out last year, so hurry to register!

This week was stacked with original research. First up was the Sodinokibi ransomware, which we saw being distributed via a zero-day vulnerability in Oracle WebLogic. Today, we also released our findings on a new variant of Qakbot, which is more difficult to detect than older versions.

Finally, we also have our weekly Threat Roundup, which you can find on the blog every Friday afternoon. There, we go over the most prominent threats we’ve seen (and blocked) over the past week.

UPCOMING PUBLIC ENGAGEMENTS WITH TALOS

Location: Industriens Hus, Copenhagen, Denmark

Date: May 29

Speaker: Paul Rascagnères

Synopsis: Paul will give an overview of an espionage campaign targeting the Middle East that we called “DNSpionage.” First, he will go over the malware and its targets and then talk about the process the attackers took to direct DNSs. The talk will include a timeline of all events in this attack, including an alert from the U.S. Department of Homeland Security.

Citrix says attackers were able to obtain persistence on their systems for about six months and may have stolen employees’ personal data. The software company says the breadth of the attack is not yet known but could involve stolen Social Security numbers, names and financial information.

Financial data from several large companies was leaked online after a technology company refused to pay a ransom. German IT provider Citycomp had data stolen in an attack, including information on Oracle, Porsche and Toshiba.

Magecart launched a renewed attack on OpenCart websites. The credit card-stealing malware is going after the e-commerce platform, which is one of the three most popular shopping interfaces for sites to use.

NOTABLE RECENT SECURITY ISSUES

Description: Oracle released an out-of-band pouch for WebLogic servers that could allow an attacker to carry out remote code execution attacks. Security researchers discovered the bug being exploited earlier this month by attackers in the wild. Oracle assigned the bug CVE-2019-2725 and gave it a CVSS score of 9.8/10, highlighting how serious the issue is. WebLogix server owners are urged to update as soon as possible.
Snort SIDs: 49942, 49943

Description: A loader known as "JasperLoader" has been increasingly active over the past few months and is currently being distributed via malicious spam campaigns primarily targeting central European countries, with a particular focus on Germany and Italy. JasperLoader employs a multi-stage infection process that features several obfuscation techniques that make analysis more difficult. It appears that this loader was designed with resiliency and flexibility in mind, as evidenced in later stages of the infection process.
Snort SIDs: 49914, 49915

Keep up with all things Talos by following us on Twitter and Facebook. You can also subscribe to the Beers with Talos podcast, which comes out bi-weekly, here (as well as on your favorite podcast app). And, if you’re not already, you can also subscribe to the weekly Threat Source newsletter here.